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Abstract 

Implementations of quantum key distribution as available nowadays 
suffer from inefficiencies due to post processing of the raw key that severely 
cuts down the final secure key rate. We present a simple model for the 
error scattering across the raw key and derive "closed form" expressions 
for the probability of a parity check failure, or experiencing more than 
some fixed number of errors. Our results can serve for improvement for 
key establishment, as information reconciliation via interactive error cor- 
rection and privacy amplification rests on mostly unproven assumptions. 
We support those hypotheses on statistical grounds. 

1 Introduction 

Quantum key distribution is an emerging technology that promises information- 
theoretic security, without computational infcasibility assumptions. Taking the 
classical BB84 protocol as an example, this one comprises the following steps: 

1. Alice sends randomly polarized photons to Bob 

2. Bob measures in a random polarization basis 

3. Bob keeps track of successful measurements 

4. Bob tells Alice the polarizer settings he used 

5. Alice tells Bob which settings have been correct 

6. Both discard all incorrect measurements 

7. Both map measurement results to a bitstring 

8. Both perform error correction 

9. Both perform privacy amplification 
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In a nutshell, the idea is to exploit photons as carriers of information due 
to their incapability of being copied. This renowned result is known as the 
no-cloning theorem [17]. Hence, any unauthorized access to the information en- 
coded in the photons will result in an unnaturally high error rate, thus revealing 
the eavesdropping attempt eventually. The original protocol is found in [1]. A 
rigorous proof of security is provided in [11], for instance. 

We are particularly interested in step 8 of the BB84 protocol, in which Alice 
and Bob locate and repair errors in their bit-strings. The process is known as 
reconciliation, and involves Alice and Bob publicly exchanging parity bits in 
order to correct errors and distill identical keys. With each published parity 
bit, a piece of information leaks out and becomes visible to the adversary, which 
is the reason why reconciliation is followed by privacy amplification. Basically, 
this is the application of a strongly universal hash function on the output, in 
order to create dependencies of the final bits on the bits that the adversary 
did not get any information about, thus sufficiently decreasing the adversary's 
information. We shall not go into details about the privacy amplification, and 
refer the reader to the literature on universal hashing [13, 14, 4] as well as 
theoretical results about privacy amplification [8, 9], and references therein for 
further information. 

2 Interactive Error Correction 

Let us pay closer attention to the error correction mechanism which has been 
proposed along with the experimental implementation of BB84 [2]. Errors in 
physical transmission media often exhibit burst structures, that is, a sequence of 
consecutive errors is more likely to occur than sparse scattering. Consequently, 
a popular trick is to permute the bits in the string prior to the error correction 
in order to chop down long bursts into small pieces. Ideally, this leaves an 
almost uniform pattern of erroneous bits in the result. This is the first step in 
a protocol which has become known under the name Cascade. 

After having agreed on a publicly known permutation of bits, Alice and Bob 
take their shuffled strings and partition them into blocks of constant size k, 
such that a single block is believed to contain no more than one error with high 
probability. The protocol was first introduced in [2]. 

The problem of how errors are scattered across the raw key has been tackled 
on statistical grounds in [5]. The authors of this work assume a binomial dis- 
tribution of errors within the blocks, which is later approximated by a Poisson- 
distribution. 

We shall take a different route here, considering the process that induces 
the errors to be Poissonian, as well as adapting the initial block-size using a 
decision-theoretic approach. The authors of [5] do not provide a direct clue on 
how to choose an optimal block-size for partitioning. This is the gap we intend 
to close now. Before getting into details about how to cleverly choose the block- 
sizes, let us outline the remaining steps in the error correction process. This 
will highlight the room for improvement that an intelligent partitioning strategy 
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parity comparison ok (^) or mismatch (!) 

Figure 1: Bisective search for errors 

can exploit. 

Having split the string into blocks of equal size fc, Alice and Bob publicly 
compare parity bits of each block. Obviously one error will change the parity, 
and in general any odd number of errors will be discovered by observing dis- 
agreeing parities. However, two or any larger even number of errors will remain 
undetected with this method, which is why further stages of the process are 
to follow, once the initial correction has been completed. For the correction of 
errors, take an example-block with one indicated error, a block where a par- 
ity mismatch was observed during the public comparison. Then this block is 
searched for the error using a standard bisective search, which discloses a further 
lot of log(fc) parities of sub-blocks. The process is depicted in Figure 1 on page 
3. To spot and remove remaining errors in the string, such as present in blocks 
with an even number of errors in them, Alice and Bob repeat the shuffling and 
partitioning steps, several times with increasing block-sizes. 

Example: The inherent problem with parity checking, which motivates the 
need for the repeated shuffling and creation of larger blocks, can be illustrated as 
follows: assume that Alice and Bob share the following bit-strings, with errors 
in Bob's string being underlined, 

Alice: 0011010100101101110101010011010 . . . 
Bob: 0011011100101101000101111011000 . . . 

Partitioning into blocks of equal size and comparing parities of blocks will let 
some errors go undisclosed (parity bits are shown in the two middle rows; agree- 
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ing parities hiding existing errors are underlined): 



Alice: 00110 1 10100 1 10110 1 11101 1 01010 1 01101 10... 

1 

1 1 1 

Bob: ooiioi moo| ToiToi ToooT 1 0T1T1 1 oTioo |i . . . 

Sparing the shuffling of bits will save some errors from discovery, since two 
blocks (in this example, the 4th and 5th) with even number of errors can form 
a larger block with an even number of errors again. Therefore, permuting the 
bits is inevitable to avoid such an undesirable coincidence. 

Since the error correction up to now may be ineffective, as still having missed 
some errors, Alice and Bob continue by comparing parities of random subsets of 
bits they publicly agree on. Upon parity mismatch, a bisective search similarly 
as above is performed to find and erase the error. In order to avoid information 
leaking to the adversary, the last bit from each random subset is deleted. This 
deletion is also done after comparing parities of blocks in the previous steps, for 
the same reason. 

The point at which almost all errors have been removed is detected by count- 
ing the number of successful comparisons after having discovered the last error. 
After a sufficient number of successful trials (20 is the number proposed in 
[2]), the strings are accepted as identical, regarding the probability of errors 
remaining undetected as negligible. 

The protocol Cascade is based on this procedure and has been introduced 
in a later paper [3] , which presented improvements to the original reconciliation 
protocol sketched above. Among the changes is the removal of the bit-deletion 
step for the sake of detecting more errors faster, so the task of information 
leakage reduction is shifted to the privacy amplification stage. The naming 
stems from the strategy of increasing sizes of blocks in the first stages of the 
protocol. Although a theoretical analysis of the protocol is provided, the authors 
of [3] , as well as those of [2] abstain from an analytical treatment of block-size 
choices. Nevertheless, they give a simple heuristic based on estimating the error 
frequency by direct comparison of a random sample of bits is provided in [2]. 
These bits have to be sacrificed for the sake of privacy too, if that approach is 
adopted. To summarize, the error correction protocol in charge of current QKD 
implementations relies on 

Assumption 1 A block-size exists, such that by partitioning the raw key into 
blocks of that given size, each block contains at most one error. 

It is this assumption that we seek to support by our upcoming theoretical 
considerations. 



3 An error scattering model 

We choose the Poisson process as the natural model for errors that occur within 
a sequence of bits that can be arbitrarily long. 
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Figure 2: Example error intensity parameter process 



Definition 2 (Poisson process [10]) A Poisson process is a family of dis- 
crete counting measures {N(t) : t > 0}, which satisfy the following conditions: 

1. N(0) = (no events yet at the beginning). 

2. The process has independent increments. 

3. The number of events in any interval of length At is Poisson distributed 
with mean XAt. That is, for all t, At > 0, 

Pr {N(t + At) - N(t) =n}= (A ' ' ' e~ x - At , n = 0, 1, 2, . . . . 

In other words, the expected number of events linearly increases with the 
length of the block. 

Our Poisson process model N(t) will count the total number of errors in the 
bit string at time t. Since our blocks should be chosen such that the expected 
additional number of errors after taking a time-step At is only 1 . The intensity 
parameter A determines the frequency of events, i.e. errors in our case. 

Assume that this intensity-parameter remains constant over a unit of time, 
and denote it by A G [0, oo). Figure 2 on page 5 shows an example with finite 
time horizon T, and gamma-distributed error-rate (with parameters a = 10 and 
b = 2 for the gamma-distribution), remaining constant over short periods of 
time. 

The probability of exactly k errors within a time unit is found from the law 
of total probability: let X be the number of errors per time-unit, then 
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Pr{A = fc}= / Pr{A = k\\ = x}Pr {\ = x} dx. 
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(1) 



Poisson distributed intensity 
with parameter A parameter 



For the intensity-parameter, we assume a gamma-distribution. This choice is 
intuitively reasonable, as this class is flexible and supported on the nonnegative 
real line. Plugging into (1) the density of the Gamma-distribution given by 

/(AM> = { p-'^' £1 
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and the density of the Poisson-distribution, which is 

A fe 



/(fc | A) = __ e -A ; 



we find 



Pr{X = k} = — — — — - / x^-'e-^+^dx 
1 ' k\T(a)J 

b a T(k + a) 



k\ (b+l) k + a T{a)'' 



(2) 



where T denotes Euler's Gamma-function. Figure 3 on page 6 shows an example 
of this density with (arbitrarily chosen) parameters a = 10 and 6 = 2. 
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Figure 3: Example of error probabilities under Cox process error scattering 

This discrete probability density has a closed form expression for its first 
moment. The expected number of errors per time unit for this model is 

oo 

WjX = ^ k ■ Pr {k errors per time unit} = — . (3) 

k=0 

So far, we are almost done, because Assumption 1 stated in the previous 
section can now easily be fulfilled: simply choose the block size inverse to the 
expected number of errors, which will eventually leave a single error per block. 
This can theoretically be justified by considering the following result, related 
to Poisson processes in general: as we explicitly know the expected number of 
errors within time-span At, which is | • (At). Assuming that the bits come in 
at frequency /, then if n denotes the number of arriving bits within At, we have 
f ■ At = n and the block-size in terms of bits is the solution of the equation 

- • - — 1 i e 

b f ' 

f 

initial block-size n « — — , 
a/b 

which is the block-size (in bits) that the Poisson process gives us. Observe that 
we have a constant block-size again. The only difference to the original Cascade 



6 



variant is that it originates from a probabilistic model, rather than from pure 
intuition. 

All calculations above were done with the Maple software [6] . The density 
of X can be derived by appropriately substituting terms under the integral to 
obtain the same form as for a Gamma-distribution (with different parameters, 
though). Then the normalizing constant takes the same form as for the gamma- 
density, giving the result. 

Using the density (2), we can give a formula for the probability of seeing 
more than to errors during a time unit as 



Pr{X > m} = 



b a (a) 



m+1 



(m + l)!(6+l) a + m + 1 



2*1 



1. 



to + a - 
to + 2 



1 



where a, b > describe the Gamma-distribution of the intensity-parameter, 2-F1 
is the hypergeometric function (see Equation (9)), and (a) m is the Pochhammer 
symbol (see Equation (10)). 

Since error correction in the way used with quantum key distribution relies 
on public parity comparisons, the event of missing an error is equal to the event 
of having an even number of errors. The probability that the parity check can 
indicate an error, is calculated as follows (the derivation is shown in Section 4): 



Pr {odd number of errors} = p dd 



1 



6 + 1 



For a finite string of length 2to + 1 , this probability is 

„, , , „/ l,m + 2+§,m+ § + § 
p = p odd -C(a,b,m). 3 F 2 ^ m + 2 ] m+ f 



(5) 



(6) 



where 



C(a,b,m) = 



b a T(2m + 3 + a) 



T(a)(2TO + 3)! (b + l)2m+3+a ' 

The previous results are an appealing tool for a proper choice of the param- 
eters if an error-correcting code shall be used with the scheme. Employing clas- 
sical error correction mechanisms may not work well, since our wish is to detect 
eavesdropping via a raised error rate. Therefore, we cannot adopt any assump- 
tion on how many errors will occur at maximum, and classical error-correcting 
codes can no longer be used for that matter. However, if the probability of see- 
ing more than to errors can be bounded, then such codes could become indeed 
applicable. We shall not go into further details about this here. 



4 Proofs 

This section is dedicated to proving equations (3), (4), (5) and (6). 
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For the probability distribution function let us first substitute c := 6+1 into 
(2), and set 



F(m) = Pr{X <m} = YPr{X = k} = V -±±±!^±— 
K ' 1 ~ 5 ^ x 1 ^ k\ 6 + l) k + a T (a) 

k=0 k=0 v ' v ' 



b a T(k + a) 
b+l) k + a T 

^ T(k + a) 



E 



(6 + l)°r(a)^fc! (6 + 1)* 



OC 



E 

fc=0 



T(k + a) 
kl c k 



(7) 



Using the Maple software [6], we obtain for the finite sum (7), 



g m - E -j^r- 

k=0 



r(m + 1 + a) ■ 2 F X 



l,m + a + 1 

TO + 2 



(8) 



where 



ai, . 



E 

fc=0 



(m + l)!c m+1 

(ffliMggjfc ■ ■ ■ (gp)fc z fc 
(&l)fe(&2)fc • • • (& 9 )k fc! 



(9) 



(10) 



is the generalized hypergeometric function, and 

J( _|_ 

{x)n ■■= rt ; - + l)(z + 2) • • • (x + n - 1) 

1 [X) 

is the Pochhammer symbol. Useful special cases are (1)^ = kl, as well as 
(2) fc = (fc + 1)!. 

It is important to notice that the parameters of the Gamma density used 
for deriving the density (2) satisfy a, b > 0, in which case < \ = -Aj < 1, 
and the hypergeometric series in (8) converges absolutely for this argument, by 
D'Lambcrt's quotient criterion (see [12]). This is crucial for the permission to 
rearrange the infinite sums in later stages of the upcoming derivation. 

We verify expression (8) by induction. For m = 0, the hypergeometric 
function evaluates to (using (9)) 



1,1 + 

2 



(l) fc (l + a)fc 1 



k=0 



(2)fc 



kl c k 



- E 



(a)fcH 



fc=0 



(fc + l)!c fc 



E (o)fc 1 
fc! c fc ' 



fe=i 
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The last series can be written in the form 

(«)fe 1 1 , ( a )k 1 



k=i 



k=0 



(11) 



with coefficients = 1 for all k. This permits the application of an identity 
due to Eulcr (cf. [7, 16, 15]), 

S^-o-^f^Mi^)'. (12) 

l — n l — n ^ ' 



k=0 "' k=0 

with the forward difference A"a defined as 

i=0 ^ ' 

Expression (13) can be evaluated directly using the Binomial formula: 
A"ao = £(-!)* ("V"- 



(13) 



i=0 



(-1 + 1)" = 0, forn>0 
(-l)°(°)l° = l, forn = 0. 



Hence, expression (11), by setting z := ^ and thanks to the identity (12) be- 
comes (cf. also [12, pg. 46]) 



E 

k=i 



(o)fc 1 
A;! c fe 



= 1-- 



1, 



and furthermore 



1. 1 + a 
2 



1-1 

c 



(14) 



To accomplish the induction start at m = 0, we need to verify that (cf. Equation 

(8)) 

l,a+ 1 
2 



2^1 



^) r(i + «) 



The identity T(l + a) = aT(a), in connection with Equation (14) then gives 



(15) 



T(a) r(a)c((l-I)- a -l) 



= T(a), 



and claim (15) is proved. 

Now, assume the formula to be valid up to m — 1. To accomplish the in- 
duction step, let us look at the difference G(m + 1) — G(m) (cf. Equation (8)), 
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which we need to prove equal to the (m + l)-th term in the series (7). The 
difference between the m-th term and the (m + l)-th term of G(m + 1) is 



r(m + 1 + a) ■ 2 F 1 



1, m + 1 + a 
m + 2 



T(m + 2 + a) ■ 2 F 1 



l,m + 2 + a 
m + 3 



(m + l)!c m+1 



(m + 2)!c m + 2 



Using the common denominator (m + 2)! c m+2 and the relation T(x+l) = xT(x) 
to get T(m + 2 + a) = (m+l + a)T(m + 1 + a), we can substitute 



A :-- 



2-f 1 



l,m + 2 + a 

77J + 3 



l,m + 1 + a 
m + 2 



into the last expression, to obtain the following equality, which is to be verified 
c(m + 2)r(m + 1 + a)B - (m + 1 + a)T(m + 1 + a) A t_ T(m + a + 1) 



(m + 2)!c m + 2 



{m+l)\c m + 1 ' 



where the right hand side is the (m + l)-th term in the sum (7). The second 
equality follows from T(m) — (m — 1)!, as m is an integer. Canceling the terms 
T(m + 1 + a), (m + 1)! and c m+1 on both sides leaves us with 

c(m + 2)B - (m + 1 + a) A t_ 
(m + 2)c _ 

Dividing the nominator and denominator on the left hand side by c(m + 2), we 
need to verify if 

m + 1 + a 



B 



(m + 2)c 



■4 = 1. 



(16) 



Consider only the right term in the difference, and substitute the expression for 
A. Then we find 



m + l + a^ (l) k {m + 2 + a) k 1 



E 



(m + 2)c ^ (m + 3) fc k\ c k 



E 

k=0 



(m + l + a) fc+1 1 
(m + 2) fe+1 c fe +! 



(m + l + q) fc 1 
^ (m + 2) fc 1 J 

by definition of the Pochhammer symbol (10). For the other term in (16), we 
find by definition of the hypergeometric function (9), 



* = E 



(l)fc(m + l + o) fc 1 



; n (m + 2) fc klc k ^ (m + 2) fc c k 



E 



(m + 1 + a) k 1 



(18) 



Subtracting expression (17) from expression (18) leaves only the 0-th term in 
the sum, which is equal to 1, and (16) is proved. 
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The distribution function in its complete form is finally obtained by substi- 
tuting c = b + 1, and plugging (8) into (7), giving 

F(m) = Pr{X < m] 



Expected Number of Errors 

Since our model assumes Poissonian error scattering with a gamma-distributed 
intensity-parameter, recall that if the random variable X is Poissonian with 
parameter A, then W,X = A. But A is gamma-distributed with parameters 
a, b > 0, so the average number of errors per time unit will come to the average 
error rate, which in turn is the first moment of the Gamma-distribution, and 
hence found as 



Alternatively, one can verify the above relation by carrying out similar calcu- 
lations as for obtaining the distributions function. The only additional task is 
then a limit process, which can be tackled in a very similar way as shown below. 

Parity Check Failure 

We wish to prove that the probability for an odd number of errors is given by 
(5), and that for a given string that is 2m +1 bit long, the probability of having 
an odd number of errors is (6). 

We prove (5) by first proving (6) by induction, and then letting m approach 
infinity. Using (7), the probability of an odd number of errors in a string of 
length 2m + 1 is proportional to 




(b+l) a T(a) 



(m + l)!(6+l) m+1 





k =0 



E 



rn 



r(2fc + i + a ) _ r( Q + i)((i + i) a -(i-i) a ) 

(2fc + l)!c 2fe + 1 2a (l + i) a (l-i) a 




(2m + 3)!c 2m + 3 



(19) 
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where the equality can be obtained using the Maple software package. We 
verify this equality by induction. Equations (5) and (6) are obtained by sub- 
stituting c = b + 1, multiplying with / &+1 ) a r( ) ' taking the limit m — > oo and 
re-arranging terms. 

Induction start : Substitute m — into the last expression, then the problem 
is to verify whether 

r (a + i)((i + i) a -(i-i) a ) 



2a(l + i)'(l-±)° 
1,2 



r(a + 3) • 2 F 1 



a 3 
2 > 2 
2,1 



? r(a+l) 



6c 3 



is true. By applying the identity T(a+3) = (a+l)(a+2)r(a+l) and multiplying 
with c, we can cancel T(a + 1) in each term to get 



c ((i+r-(i-a B ) 

2 a(l + ±) (l-i)° 
(a + l)(a + 2)- 2 F 1 



1 



(20) 



19-1-—- 

x > ^ ~ 2 ' 2 

2 £ 

Z ' 2 



6c 2 

The hypergeometric function is by definition 



= 0. 



2*1 



1 O l £ 3_ _i ci 
x ' z "r 2 ' 2 ' 2 

9 5 

Z ' 2 



E 

fc=0 

oc 



(l) fe (2+§) fc (| + §: 



(2) fe (l) fc 



fc! c 2fc 



V (2 + f) fc (| + f) fc 1 
^ (* + !)'(§)* * 



2fe ' 



(21) 



The Pochhammer symbol satisfies the following identities, which we can use to 
simplify the terms in the series (cf. [15]): 



((/),, ( a+ i 



^(2«) 2fe , 



(a + l) k = 

3 
2 



a + fc 



a 

(2fc + l)! 
k\A k ' 



The term (|) 



k 



l) can be evaluated using (23) and (24) to give 



3 + 2fc (2fc+l)! 



3 fc! 4 k 

The nominator of the terms in the series (21) are found using (22) as 

1 

v K "* \ \* */ / 2k 



2/ t V 2/fc 



1 

/\k 



3 a 
2 + 2 



4> 



(a + 3) 



2fe- 



(22) 

(23) 
(24) 

(25) 
(26) 
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Substituting (25) and (26) into (21) gives 



2^1 



12+-- 

Z > 2 



= (o+i)(o+2)f; 



3E 

fe=0 



(o + l)(o + 2) 
jr(a + 3) 2 fc 1 

- /I I i y 2fc+3 (2fc+l)! ~rfk 
(a + l) 2 fc+2 1 



(fc + l)(2fc + 3)(2fc+l)!c 2fc 



3c 2 E 



(a+1) 



2fr 



fe=l 



fc(2fc + l)(2&- l)\c 2k 



o 2 2fc(a + l) 2 fc 1 
C ^ fc(2fc+l)! c 2fc 



6c 2 E 



(a + 1) 



2 A' 



^ (2fc + l)! c 2fc ' 



so that 



r(a + 3) 2 F! 



1 9 -J_ — - I a 

x ' z "T" 2 ' 2 ' 2 



6c 2 



E 



(g + l) 2 fc 1 

^ (2ft +1)! c 2fe ' 



Substituting z := - in the last expression, as well as in the term in square 
brackets in (20), our task is to verify whether 



^ (2k + 1)! 2az 

— 1 



E 



i 



i 



(l-z) a (l + z) a 



- 1 



holds. This is achieved, by forming the Taylor-series expansion of the right hand 
side around z = 0, turning out equal to the series on the left side. 

Induction step: To accomplish the induction step, we compare the difference 
between the results when substituting m + 1 and m into (19), which should be 
equal to the (to + l)-th term in the finite sum. 

This difference comes to 



r(2m + 3 + a) ?_ 
(2TO + 3)!c 2m + 3 ~~ 

T(2to + 5 + a) • 3 F 2 



F(2to + 3 + a) • 3 F 2 



l,TO+2+ f,TO+ § 
TO + 2, TO + | 



(2to + 3)!c 



2m+3 



1, TO + 3 



, TO 



5 _i_ a 
2 ' "" 2^2 
TO + 3, TO + | 



(2TO + 5)!c 2m + 5 
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Using the identity T(2m + 5 + a) = (2m + 3 + a) (2m + 4 + a)T(2m + 3 + a), 
and dividing by the right hand side leaves us with the claim 



1 



l,m + 2 



(2m + 3 + a) (2m + 4 + a) 



m + 2, m + | 



(2m + 4)(2m + 5)c 2 



• 3^2 



l,m + 3+ §,m+ | 
m + 3, m + | 



Let us pay closer attention to the term in square brackets. By canceling 2 from 
all four brackets in the fraction in front of the hypcrgeometric function, and 
writing down the latter as a series, we obtain 



(m + 2 + f) 



(m + 2) (m + |) c 2 



k=0 



(m + 3+f) fc (m+| + f) fc 1 
(m + 3) k (m+l) k c 2 * 



Using the identity a(a + 1)„ = (a)„ + i, we can assemble the nominator and the 
denominator into the sum's terms to find 

( m + 2+§)(m+§ + §) ~ (m + 3+f) fe (m+| + |) fc 1 



E 



(m + 2)(m+§)c 2 ^ ( m + 3 ) fc (m+|) fe 
(m + 2 + f) fc+1 (m+| + f) fe+1 i 



„2fc 



= E 

fc=0 

oo 

= E 

fe=l 



(m + 2) fc+1 (m+|) fe+1 c 2 ( fe +D 
( m + 2 +f) fe (m+| + |) fe 1 



(m + 2)fc (m - 



p. l,m + 2 + |,m-, , 



3-^2 



m + 2, m + ■ 



- 1 



and the claim is proved. 



Limit for m — > oo 

Our final task is calculating 

r(2m + 3 + a) 
m-oo (2m + 3)!c 2m + 3 3 2 



l,m + 2 



, m - 



m 



2,m + 



_ 3 
2 

5 
2 



To get rid of the generalized hypergeometric function, let us upper-bound 
the series by upper-bounding each term separately. We have 



r( l,TO + 2+f,TO + 

m + 2,m+| 



E 



(m + 2 + f) fe (m+| + f) fe 1 



< 



k=o (m + 2) k (m+l) k 
[(m + 2 + a) fe ] 2 1 



< 



E 

fe=0 
oo 

E 

Lfe=o 



[(m + 2) fe ] 2 6 

(m + 2 + q) fc 1 
(m + 2) fc & 



2k 



I 2 
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where we have used the inequality (x)k < {y)k, for < x < y. Because m is an 
integer, we can write (2m + 3)! = T(2m + 4). By substituting z := - > we 
obtain 



T(2m + 3 + a) 
(2m + 3)! 



3 F 2 (...) < 



g T(2m + 3 + a) 2 (m + 2 + a) k _ k 



fcOv 



T(2m + 4) 2 (m + 2) fe 

=:a(k) 



(27) 



Expanding the Pochhammcr symbols on the right hand side in terms of the 
gamma function, the coefficient a(k) of z k becomes 



a(k) =T(2m + 3 + a) 



r(m + 3 + a + k) T(m + 2) 



,-r(2m + 4) 2 T(m + 2 + k) T(m + 3 + a) 



-:R(m) 



= :S(m) 



Considering the terms P(m), Q(m), R(m), S(m) separately significantly simpli- 
fies matters, when we apply D'Alambert's quotient-criterion to investigate the 
convergence of the series (27). The quotient of interest is 



Otk+lZ 



k+l 



OL k Z h 



P{m + l) 2 Q(m + l) 2 R(m + 1) 5 (to + 1) 
P(m) 2 Q(m) 2 i?(m) S(m) 



where positive values are guaranteed since all involved quantities are positive. 
Let us consider the four quotients individually: 



i) P(m + 1)/P(m): This is 
P(m + 1) T(2m 



(2m + 3 + a) (2m + 4 + a), 



P(m) T(2m + 3 + a) 
because T(2m + 5 + a) = (2m + 3 + a) (2m + 4 + a)r(2m + 3 + a), 
ii) Q(m + 1)/Q(m): Using the same reasoning as before, we get 
Q(m + 1) T(2m + 4) 1 



(28) 



Q(m) 



T(2m + 6) (2m + 4)(2m + 5)' 



(29) 



Multiplying (28) with (29), we obtain a rational function with polynomials 
of equal order and leading coefficient in the nominator and denominator. 
It follows that 

P(m + l) 2 Q(m + l) 2 



lim 



P(m) 2 Q(m) 5 



1 



hi) S(m + 1)/S(m): Once more, exploiting the recurrence relation for the 
T-function, T(m + 3) = T(m + 2)(m + 2) and T(m + 4 + a) = (m + 3 + 
a)r(m + 3 + a), we find 



S(m + 1) 
S(m) 



m - 



m + 2 
3 + a 



as m 



oo. 
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iv) R(m + 1)/R{m): Analogously as for the quotient S(m + 1)/S(m), 



R(m + 1) m+3+a+k 1 1 

1 + . „ . ; < 1 + 



R(m) m + 2 + k m+2+k~ to + 2' 

where the second inequality is valid since k > 1. 

Now, choose two constants pi,P2 > 1 such that zpip 2 < 1, which is possible 
since < z < 1 is itself a constant (recall that z = ^ = jjL- and 6 > 0). 
Convergence of all quotients implies the existence of constants Mj , M 2 such 
that [P(m + l)Q(m + l)] 2 /[P(m)Q(m)} 2 < p Y for m > M x . Furthermore, 
we have S^to + l)/5'(m) < 1 for all m > (because a > 0), and finally, 
R(m + l)/R(m) < p 2 for every m > M2. Setting q := zpi/92 and choosing 
M :— max {Mi, M2}, we find a uniform bound for (27) given by the geometric 
series with quotient q < 1. Hence, the series (27) is ultimately bounded by a 
constant L > for every m > M. So 

r(2m + 3 + o) 2 
(2m + 3)! •3^(")<£ 

for to > M, and furthermore, 

T(2m + 3 + a) r ,(\,m + 2+$,m 

L 2 



3 

' ' - rrl^L (2m + 3)lc 2m + 33F \ m + 2, to + ^ 

T2 



since c = b + 1 > 1 . 
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